Introduction: In the dynamic field of digital forensics, choosing the right acquisition method is pivotal. DA Forensics, Inc. has selectively evaluated the full file system (FFS) acquisition versus advanced logical acquisition. This assessment focused primarily on the total data points accessible through Cellebrite’s Physical Analyzer, without delving into every database and field. Our findings, especially those involving the use of Magnet Forensics’ VeraKey, underscore our ability to obtain a comprehensive range of data, ensuring that no aspect is overlooked in our digital forensic analysis. This approach reflects our commitment to thoroughness and meticulous attention to detail in uncovering and analyzing digital evidence.
Background: At DA Forensics, we are dedicated to utilizing the most effective and reliable tools. Our acquisition and thorough testing of VeraKey from Magnet Forensics are testaments to our commitment to delivering top-notch forensic services.
Test Device: We chose an iPhone Xr with 128 GB storage and iOS 15.6.1 for our evaluation. Its prior use in everyday scenarios provided a real-life context for our testing, aligning with our focus on practical and pertinent forensic examination.
VeraKey Acquisition:
Data Identified: The phone initially displayed about 50.14 GB of used space.
Acquisition Details: VeraKey effectively identified an 80.28 GB partition, extracting an impressive 93.3 GB of data. This includes keychain, password list, and a detailed acquisition report.
Key Insights: VeraKey’s ability to capture significantly more data than what is visibly used (93.3 GB vs. 50.14 GB) demonstrates its effectiveness in thorough data retrieval.
Cellebrite UFED Advanced Logical Acquisition:
Outcome: Cellebrite UFED extracted only 24.23 GB of data from the same device.
Comparison: VeraKey’s full file system acquisition extracted substantially more data, showcasing its superior capability in acquiring extensive data.
Detailed Analysis and Findings:
Full File System Acquisition (FFS):
- Acquires significantly more data overall – 793,263 data points compared to 69,196 for Advanced Logical.
- Captures crucial data types like Device Connectivity, Emails, Instant Messages, Notes, Recordings, Searched Items, and Web History.
- Retrieves more entries in shared data types, e.g., 67,370 Web History entries vs. 204 by Advanced Logical.
- Ensures comprehensive data collection, reducing the risk of missing relevant evidence.
Advanced Logical Acquisition:
- Focuses on readily available user data, less comprehensive compared to FFS.
Illustrative Data Comparison:
To better understand the differences in data acquisition methods, please see the accompanying illustrations below. Included are a comprehensive chart and Cellebrite snapshots for both the full file system and advanced logical acquisitions. We utilized Cellebrite’s Physical Analyzer to analyze and compare the data from both methods. The results, including the number of data points, are displayed in Figure 1. These visual aids effectively demonstrate the distinct differences in the amount and type of data retrieved by each method, offering both quantitative and qualitative insights.
DA Forensics’ Offer to Attorneys and Digital Forensic Examiners:
Understanding the critical need for detailed and comprehensive data in legal and forensic cases, DA Forensics offers VeraKey full file system acquisition services. With our advanced expertise, proven methodologies, and commitment to precision, we are equipped to provide unparalleled support in your investigations. Our team, certified in GIAC Forensic certifications, ensures the highest standards in technical competence.
Disclaimer: In the above comparison, we utilized Cellebrite’s UFED and Magnet Forensics VeraKey for data acquisitions, and Cellebrite Physical Analyzer for examining the images. It is important to note, however, that the primary focus and significance of our work lie in the types of acquisitions performed, rather than the specific tools employed.
About DA Forensics Inc.:
DA Forensics, under the expert guidance of George Rodriguez, a former Senior Special Agent with Homeland Security Investigations and a Master’s Degree holder in Computer Forensics from George Mason University, provides a wide array of investigative services, including digital forensics, financial probes, fraud detection, and intellectual property protection. For attorneys and forensic examiners seeking a leader in digital forensics, DA Forensics stands ready to assist with cutting-edge tools and seasoned expertise.
Consider DA Forensics Inc. for your next forensic challenge, where we offer not just services, but solutions that make a difference.
